AI deployment compliance goes beyond NIS2, it also covers the AI Act (high-risk system obligations from 2 August 2026), ISO 27001, and GDPR. Compliance isn't declarations but artifacts: technical documentation, logs, risk analysis, and control mappings that survive an audit.
This cluster shows how to turn regulatory requirements into audit readiness for AI deployments. We cross-map NIS2, the AI Act, and ISO 27001, because the same controls (information classification, logging, access management) serve several regimes at once if you design them well. We spell out which ISO 27001 controls are worth mapping to an AI vendor today and which 7 documents you actually produce for an auditor. The key difference from competitors: we don't leave you with a list of obligations, we show how on-prem architecture simplifies meeting them (human oversight, data isolation, full logging). We monitor and date AI Act and Digital Omnibus deadlines.
From 11 September 2026 a manufacturer of products with digital elements reports actively exploited vulnerabilities and severe incidents on three clocks, 24 h, 72 h and 14 days, through one platform to the CSIRT and ENISA. What it means and how to prepare.
Four regimes, one set of evidence, and from autumn 2026 a fifth for anyone making products with software. How to map NIS2, AI Act, GDPR, ISO 27001 and the CRA onto one control matrix, evidence per control, and how to separate the four reporting clocks.
The sovereignty test in IT procurement does not check the vendor's country, it checks who controls the architecture and the model weights. That is why a local cloud does not pass it by default, while on-prem AI meets its core. Thresholds, five criteria and how to score an offer.
Article 50 of the AI Act applies from 2 August 2026. When you self-host, you are often provider and deployer at once, which changes your transparency duties.
A vendor's boilerplate DPA stays silent exactly where an auditor looks first. Eight clauses whose absence breaks an NIS2 or GDPR audit: from the sub-processors behind the model API and training use of your data, to logs, breach notice and data deletion.
When a manufacturing AI system is high-risk under the AI Act and when it is not. Two routes to high-risk, step-by-step classification, and what the July 2026 Digital Omnibus changed. Plus the effect on the on-prem versus cloud choice.
The ten Article 21 NIS2 areas mapped to an AI system. For each area, the question an auditor will ask and the single artefact you need to show.
NIS2 does not ask for a standalone AI policy. It asks that your AI system sits inside seven documents you already produce. Here is the list, with a mapping table.
ISO 27001 has no concept of "AI," yet an AI vendor touches three of its controls at once: supplier relationships, information classification and flow, and logging. Which to map today – and how they tie into NIS2.
It depends on the use (e.g. HR, scoring, medicine, critical infrastructure). Classification is done per use-case; we describe an assessment pattern.
It doesn't replace it but helps significantly, many controls overlap; we show the mapping.
Among others: risk analysis, an AI policy, a system register, logs, technical documentation, and evidence of board oversight.
Want to apply this to your case: architecture, compliance, and cost?
→ Book 30 min